Clear your Secure Boot keys

Secure Boot works from a set of key databases stored in your firmware: a Platform Key, a Key Exchange Key, and lists of allowed and blocked signatures. Anything that boots has to be signed by something in there.

On the very first launch, BadPing installs its own bootloader, and that bootloader has to be trusted by your firmware. It cannot be, while the databases are full of factory keys that were never issued to us.

So you empty them. Clearing the Platform Key puts your firmware into Setup Mode, a state where new keys can be enrolled without being signed by an existing one. Our bootloader enrolls its keys there, and your machine leaves Setup Mode with Secure Boot fully enforcing again, this time trusting us.

To suspend it: open Manage BitLocker from the Start menu, then choose Suspend protection on your system drive. Turn it back on after setup is complete. Your recovery key is also saved to your Microsoft account at account.microsoft.com/devices/recoverykey if you signed in with one.

• If you dual-boot Linux with a signed shim, clearing the keys changes how it boots. Ask on Discord first.
• Some anti-cheats for other games check Secure Boot state and may complain until the bootloader is installed.
• Work laptops managed by an employer usually block this outright, and you should not be trying it on one.

Pick your motherboard or laptop brand. Menu names move around between BIOS versions, so treat these as where to look rather than an exact path, and fall back to the generic instructions if yours does not match.

Back in Windows, open PowerShell as administrator and run:

Get-SecureBootUEFI -Name SetupMode

Look at the Bytes column in the output. A value of 1 means you are in Setup Mode and ready to launch the loader. A value of 0 means the keys are still enrolled and the clearing step did not take.

Two other things you can expect to see, both normal at this point:

• msinfo32 reports Secure Boot State as Off, because no Platform Key is enrolled yet.
• Confirm-SecureBootUEFI returns False for the same reason.

Both flip back after the first launch enrolls our keys. If Get-SecureBootUEFI errors with an unsupported platform message instead, your machine is booting in Legacy mode and you need to revisit the BIOS page.

Not every firmware exposes key management. Work through these before giving up:

1. 1.
   Make sure you are in Advanced or Expert mode, not the simplified first screen.
2. 2.
   Set Secure Boot Mode to Custom if that option exists. Standard mode hides key management on most boards.
3. 3.
   Set a BIOS supervisor or administrator password. Several laptop vendors only reveal these menus once one is set.
4. 4.
   Update your BIOS to the latest version from the manufacturer, then look again.
5. 5.
   Check for a Restore Factory Keys entry. If that exists, the clearing option is almost always next to it.

If none of that surfaces it, your firmware is locked down and the machine cannot run our stack. That is common on prebuilt office desktops and managed laptops. Ask on Discord with your exact model before you buy anything else.